fix(keystone): render empty Secret data as {} instead of null

The keystone-fernet-keys and keystone-credential-keys Secrets rendered
data: with no value, which YAML parses as null rather than an empty
map. GitOps controllers that re-apply these Secrets on every sync
(they are Helm pre-install hooks) can send that literal null through
as a "clear this field" instruction, wiping the fernet/credential
keys written out-of-band by the setup jobs and rotation cronjob.
Render data: {} instead, which merges as a no-op.

Assisted-by: Claude Sonnet 5.0
Change-Id: I93628b5cfd589b3d53d315d1eb6bf64d9ccba33c
Signed-off-by: Doug Goldstein <cardoe@cardoe.com>

Author: cardoe

keystone/templates/secret-credential-keys.yaml

@@ -24,5 +24,5 @@ metadata:
     "helm.sh/resource-policy": keep
 {{ tuple "identity" "credential" $envAll | include "helm-toolkit.snippets.custom_secret_annotations" | indent 4 }}
 type: Opaque
-data:
+data: {}
 {{- end }}

keystone/templates/secret-fernet-keys.yaml

@@ -25,6 +25,6 @@ metadata:
     "helm.sh/resource-policy": keep
 {{ tuple "identity" "fernet" $envAll | include "helm-toolkit.snippets.custom_secret_annotations" | indent 4 }}
 type: Opaque
-data:
+data: {}
 {{- end }}
 {{- end }}

releasenotes/notes/keystone-b5a6e8b38948a6f7.yaml

@@ -0,0 +1,13 @@
+---
+fixes:
+  - |
+    The ``keystone-fernet-keys`` and ``keystone-credential-keys`` Secrets
+    rendered their ``data`` field as an empty/null value instead of an empty
+    map. GitOps tools such as Argo CD track and re-apply these Secrets on
+    every sync (since they are Helm ``pre-install`` hooks), and a patch that
+    contains an explicit ``null`` for ``data`` clears any keys already
+    present, wiping out the fernet/credential keys written out-of-band by
+    the ``keystone-fernet-setup``/``keystone-credential-setup`` jobs and the
+    fernet rotation cronjob. ``data`` is now rendered as an empty map
+    (``{}``), which merges as a no-op instead of clearing the field.
+...